draft-ietf-plants-merkle-tree-certs.See: Description
| Interface | Description |
|---|---|
| MerkleTreeHash |
Operator interface for the hash function used in the Merkle tree, as defined
by Section 4 of draft-ietf-plants-merkle-tree-certs.
|
| MTCCosigner |
Operator interface for producing a cosigner signature over the subtree
[start, end) of an MTC issuance log, per Section 5.3 of
draft-ietf-plants-merkle-tree-certs. |
| MTCCosignerVerifier |
Operator that verifies a single cosigner's signature over a CosignedMessage
as defined by Section 5.3.1 of
draft-ietf-plants-merkle-tree-certs.
|
| MTCCosignerVerifierProvider |
Looks up an
MTCCosignerVerifier for a given cosigner trust anchor ID. |
| MTCSignatureVerifier |
Operator interface for verifying a single cosigner signature over a
pre-encoded CosignedMessage, per Section 5.3.1 of
draft-ietf-plants-merkle-tree-certs.
|
| Class | Description |
|---|---|
| LandmarkCertificateManager |
Issuance- and relying-party-side helpers for landmark subtrees, per
Sections 6.3 and 7.4 of draft-ietf-plants-merkle-tree-certs.
|
| LandmarkCertificateManager.TrustedSubtreeEntry |
A trusted subtree along with the reference checkpoint that proved its
consistency, per Section 7.4.
|
| LandmarkCertificateManager.TrustedSubtreeManager |
Maintains a relying-party-side list of trusted subtrees by accepting new
landmarks that come with a cosigned reference checkpoint and a subtree
consistency proof.
|
| LandmarkCertificateManager.TrustedSubtreeManager.Checkpoint |
A snapshot of the log: tree size and root hash.
|
| LandmarkSequence |
The published landmark sequence for a single issuance log, as defined by
Section 6.3 of draft-ietf-plants-merkle-tree-certs.
|
| MerkleTreeCertEntry |
Parses (and encodes) a single log entry per Section 5.2.1 of
draft-ietf-plants-merkle-tree-certs:
struct {
MerkleTreeCertEntryExtension extensions<0..2^16-1>;
MerkleTreeCertEntryType type;
select (type) {
case null_entry: Empty;
case tbs_cert_entry: opaque tbs_cert_entry_data[N];
}
} MerkleTreeCertEntry;
For
tbs_cert_entry, the body is the DER contents octets
of a TBSCertificateLogEntry — that is, the SEQUENCE tag and length
octets are stripped. |
| MerkleTreeCertEntryExtension |
A single Merkle Tree certificate log-entry extension, per Section 5.2.1 of
draft-ietf-plants-merkle-tree-certs:
struct {
MerkleTreeCertEntryExtensionType extension_type;
opaque extension_data<0..2^16-1>;
} MerkleTreeCertEntryExtension;
The
extension_type is a uint16 (the draft assigns no concrete
values yet) and extension_data is opaque<0..65535>. |
| MerkleTreeCertEntryType |
Constants for the
MerkleTreeCertEntryType enum defined in
Section 5.2.1 of draft-ietf-plants-merkle-tree-certs:
enum {
null_entry(0), tbs_cert_entry(1), (2^16-1)
} MerkleTreeCertEntryType;
The on-wire encoding is a big-endian uint16. |
| MerkleTreeCertificateValidator |
Validates a Merkle Tree Certificate (MTC) per Section 7.2 of
draft-ietf-plants-merkle-tree-certs.
|
| MerkleTreeCertificateValidator.RevokedRange |
A half-open range
[start, end) of revoked certificate serial
numbers, per Section 7.5 of the draft. |
| MerkleTreeCertificateValidator.TrustedSubtree |
Represents a trusted subtree (typically a landmark subtree predistributed
to the relying party).
|
| MerkleTreeCertificateValidator.ValidationParams |
Parameters supplied by the relying party for certificate validation.
|
| MerkleTreePrimitives |
Merkle Tree primitives for Merkle Tree Certificates (PLANTS).
|
| MerkleTreePrimitives.SubtreeInfo |
Simple container for a subtree interval (start inclusive, end exclusive).
|
| MTCCertAuth |
Identity-side helper for an MTC Certification Authority, per Section 5 of
draft-ietf-plants-merkle-tree-certs.
|
| MTCCertificationAuthorityCertificate |
Helpers for the CA certificate representation defined by Section 5.5 of
draft-ietf-plants-merkle-tree-certs.
|
| MTCContentSigner |
Issuer-side
ContentSigner that emits an MTC signatureValue
(an encoded MTCProof) for an EE Merkle Tree certificate per
Section 6.1 of draft-ietf-plants-merkle-tree-certs. |
| MTCCosignedMessage |
Wire encoder for the CosignedMessage struct defined by Section 5.3.1 of
draft-ietf-plants-merkle-tree-certs:
struct {
uint8 label[12] = "subtree/v1\n\0";
opaque cosigner_name<1..2^8-1>;
uint64 timestamp;
opaque log_origin<1..2^8-1>;
uint64 start;
uint64 end;
HashValue subtree_hash;
} CosignedMessage;
cosigner_name and log_origin are the ASCII strings
"oid/1.3.6.1.4.1." + <dotted-decimal trust anchor ID>, constructed
from the binary trust anchor IDs supplied by the caller. |
| MTCLog |
Immutable identifier for an MTC issuance-log subtree window: the CA that
operates the log, the log number (the upper 16 bits of the cert serial per
Section 6.1 of draft-ietf-plants-merkle-tree-certs) and the subtree's
[start, end) index range (uint48). |
| MTCProof |
The MTCProof structure encoded in the X.509 certificate signatureValue per
draft-ietf-plants-merkle-tree-certs,
Section 6.1.
|
| MTCSignature |
A single cosigner signature, as it appears inside the TLS-encoded MTCProof
defined by
draft-ietf-plants-merkle-tree-certs, Section 6.1:
struct {
TrustAnchorID cosigner_id;
opaque signature<0..2^16-1>;
} MTCSignature;
opaque TrustAnchorID<1..2^8-1>;
The cosigner ID is the binary trust anchor ID per Section 3 of
draft-ietf-tls-trust-anchor-ids — the base-128 OID-component bytes
only, without the ASN.1 RELATIVE-OID tag or length octets.
|
| MTCSignatureAlgorithm |
String constants for the cosigner signature algorithms defined by Section
5.3.2 of draft-ietf-plants-merkle-tree-certs.
|
| MTCSignatureVerifierProvider |
Single-cosigner
ContentVerifierProvider adapter for MTC verification. |
| TrustAnchorIDs |
Utilities for constructing and parsing the binary trust anchor IDs reserved
by Section 5.1 of draft-ietf-plants-merkle-tree-certs under each CA ID:
{caID 0 N} — issuance log N (Section 5.2)
{caID 1 N L} — landmark L of log N (Section 8.2)
{caID 2 N L} — landmark group containing landmark L
and earlier (Section 8.2.1)
The binary representation is the base-128 OID-component encoding used
inside ASN.1 RELATIVE-OID contents (Section 3 of draft-ietf-tls-trust-anchor-ids);
it has no ASN.1 tag or length prefix. |
| Exception | Description |
|---|---|
| InvalidProofException |
Thrown when a Merkle tree inclusion or consistency proof fails validation.
|
draft-ietf-plants-merkle-tree-certs.
JCA-free and lightweight-crypto-free operator abstractions, plus the proof / cosigner
validation pipeline. Lightweight bindings live in org.bouncycastle.cert.plants.bc
and JCA bindings in org.bouncycastle.cert.plants.jcajce.